How to Retire On-Premises Exchange or Harden the Hybrid Server You Must Keep

Retrospective: this article looks back at events from March 2021, written in 2026 with the benefit of hindsight.

On-premises Exchange servers were exploited repeatedly from 2021 to 2022. If you've moved mailboxes to Exchange Online, you may be able to retire your last server. If not, here is how to harden it.

Option A: Retire the last Exchange server

Microsoft supports removing the last Exchange server in hybrid environments when all mailboxes are in Exchange Online and you manage recipients through other means. Microsoft provides the Exchange Management Tools and PowerShell recipient management to manage Exchange attributes in Active Directory without a running Exchange server.

Steps in outline:

1. Confirm all mailboxes, public folders and relay needs have moved to Exchange Online.
2. Move SMTP relay to Exchange Online connectors or an alternative.
3. Install the management tools and validate recipient management.
4. Shut down the server, monitor, then uninstall or decommission according to Microsoft guidance.

Option B: Harden the server you must keep

If you still need an Exchange server (on-premises mailboxes, specific relay or application needs):

• Patch with the latest Cumulative Update and Security Update; enable automatic emergency mitigation (the Exchange Emergency Mitigation service).
• Don't publish it to the internet unless required. If hybrid features need it, restrict inbound access to Microsoft 365 IP ranges where possible.
• Enable Extended Protection and other Microsoft-recommended hardening.
• Deploy Defender for Endpoint with Exchange-specific protections.
• Run the Exchange Health Checker script regularly.
• Monitor IIS logs and web directories for unexpected files.

Either way

Hunt for historical compromise: scan for web shells and unusual ASPX files, review scheduled tasks and new accounts.